Last updated: July 23, 2026
Privacy Policy
This policy describes how Pulsar67 LLC (“Pulsar,” “we,” “us”) handles information when you use the Pulsar AI chat service. We do not sell personal data or chat content. We do not use your chats to train our AI models, third-party foundation models, or to assist third-party training.
1. How Pulsar works (technical overview)
This section is meant to be readable and technically honest: what is encrypted, what must be plaintext to generate a reply, what we store, and what we cannot see. Engineers should recognize a real architecture — not marketing vapor. Legal terms for use of the Service are in the Terms of Service.
1.1 Account data vs chat content
Account and billing data (email, name, hashed password, plan/subscription status, Stripe identifiers, API key hashes/prefixes, rate-limit counters, and similar operational signals) are stored so we can run accounts, billing, and abuse prevention. That is separate from chat content (message bodies, titles, and related conversation text). We do not treat stored signed-in chat history as readable data we collect for monitoring or training.
1.2 Signed-in chat: client-side encryption at rest
For signed-in users, persisted chat history is encrypted in the browser before it is stored. Staff and database operators cannot read plaintext chat history from our production database.
- Password-derived keys. A key encryption key (KEK) is derived in your browser from your account password using PBKDF2-SHA256. A data encryption key (DEK) encrypts chat fields. The DEK is wrapped with the KEK. We store the wrapped DEK and salt — not your password and not the raw DEK. Unlocking happens in the browser when you sign in with your password.
- AES-GCM at rest. Message bodies, titles, and related chat fields are encrypted with AES-GCM under the DEK before storage. What remains on our servers for encrypted chats is ciphertext plus non-content metadata (for example role, timestamps, and conversation identifiers).
- In transit. Traffic between your browser and Pulsar is protected with TLS when HTTPS is configured. After unlock, your browser decrypts history locally for display.
- Password loss. If you lose your password, we cannot recover encrypted history. We do not offer a server-side recovery wrap today.
This is at-rest encryption of stored history. It is not end-to-end encryption of the inference path: prompts must be plaintext to the model while a reply is generated.
1.3 Inference: plaintext for generation
To generate a reply, the model must receive the prompt in plaintext. Pulsar’s models may run on GPU servers we operate and/or on a variety of third-party hosting and infrastructure services we use to serve those models. In either case, the models are Pulsar’s; for the duration of a completion, our application path and the model-serving infrastructure necessarily process the prompt and streaming reply text in plaintext as required to produce a response.
- During generation. While a completion is running, our application servers may hold short-lived generation buffers (prompts and partial output) in plaintext so the reply can stream and resume if you disconnect.
- After a reply. When generation finishes, signed-in chat content is persisted as ciphertext under your DEK. We do not use chat content to train models. We do not sell chat content. We do not monitor chat activity or review users’ chat histories.
- Third-party infrastructure. When we use third-party hosting to run models, that infrastructure may process plaintext prompts and outputs as needed to generate replies. We select and configure providers to operate the Service; we do not sell your chats to them for advertising or training, and we do not use chats to train our models or theirs.
1.4 Guest (signed-out) chat
Guest sessions are limited and temporary. They are not covered by the signed-in password-derived DEK encryption flow. Guest turns may be held briefly in a server-side session cache so the conversation can continue, then expire (on the order of a day). Guest chat does not include Pro features such as reasoning or web search; those are forced off for guest completions. Message count is capped (default on the order of a handful of turns) before signup is required.
1.5 Rate limits and abuse signals
We enforce rate limits and plan entitlements using account- and service-level signals (for example request counters, timestamps, and similar operational logs). Suspension or throttling for abuse is based on how the Service is used — not by reading ciphertext chat histories. Consistent with our privacy design, we cannot review prior encrypted chat content in production.
1.6 Model-embedded safeguards
Safeguards intended to help reduce harmful or prohibited use are built into the models themselves (for example refusal-oriented behavior at generation time). These are not a guarantee of perfect safety, and they are not a substitute for reviewing chat histories — which our at-rest design does not allow staff to do.
2. Information we collect
- Account. Email, name, and password (password is hashed; we never store it in recoverable form).
- Billing. Subscription status and Stripe customer/subscription identifiers. Card details are handled by Stripe — we do not store full payment card numbers.
- API keys. If you create Pro API keys, we store a hash and a short prefix — not the full secret after creation.
- Usage & ops. Timestamps, plan entitlements, rate-limit counters, runtime health signals, and similar operational logs needed to run the service. These are account- and service-level signals, not readable chat transcripts.
We do not collect your chat messages, titles, or related chat content as readable data for our own use, monitoring, or training. Section 1 describes how chat storage and encryption work.
3. How we use data
We use the information we collect solely to:
- Provide accounts, chat, and related product features
- Process subscriptions and invoices via Stripe
- Enforce rate limits, plan entitlements, and abuse prevention based on account- and service-level behavior (not by reading chat histories)
- Operate, secure, debug, and improve infrastructure reliability — including our own servers and third-party model-hosting infrastructure we use to serve Pulsar’s models
We do not sell personal data or chat content. We do not use your chats to train our AI models, third-party foundation models, or to assist third-party training.
4. Who can see prompts
- Your browser after you unlock with your password (history is decrypted locally for display).
- Pulsar systems and model-serving infrastructure for the duration of a completion — our application servers and the GPU / hosting environments (ours and/or third-party) that run Pulsar’s models — so a reply can be generated. We do not use prompts to train models or to monitor conversations.
- Stripe for payment and subscription data (not chat message bodies).
- Optional web search. If you enable web search (Pro), search queries leave your device to the search provider; encrypted-at-rest chat history remains as described above.
5. Retention
- Encrypted chats. Ciphertext for active conversations is retained until you delete them or close your account. Soft-deleted (trashed) conversations are typically retained for about 30 days before permanent purge so they can be restored during that window.
- Guest sessions. Temporary guest chat cache expires on a short TTL (on the order of a day).
- Account deletion. There is no self-serve account wipe in the product today. Email privacy@example.com from your account address to request deletion of your account and associated data. We will process requests within a reasonable time, subject to legal and billing retention needs (e.g. Stripe records).
6. Security
We use industry-standard practices for account authentication, TLS in transit (when HTTPS is enabled), and client-side AES-GCM for chat at rest. No method of transmission or storage is perfectly secure. Plaintext during inference is required to generate replies; at-rest encryption is designed so stored history is not readable chat content we collect or review.
7. Children
Pulsar is not directed to children under 13, and we do not knowingly collect their personal information.
8. Changes
We may update this policy. The “Last updated” date will change when we do. Continued use of the service after an update means you accept the revised policy.
9. Contact
Pulsar67 LLC. Privacy questions or data requests: privacy@example.com